diff options
author | Dan Rosenberg <drosenberg@vsecurity.com> | 2011-01-12 19:59:41 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2011-01-13 11:03:08 -0500 |
commit | 455cd5ab305c90ffc422dd2e0fb634730942b257 (patch) | |
tree | c20e6c3f8e58967991ce9002abe03d31897b171c /Documentation | |
parent | 351f8f8e6499ae4fff40f5e3a8fe16d9e1903646 (diff) |
kptr_restrict for hiding kernel pointers from unprivileged users
Add the %pK printk format specifier and the /proc/sys/kernel/kptr_restrict
sysctl.
The %pK format specifier is designed to hide exposed kernel pointers,
specifically via /proc interfaces. Exposing these pointers provides an
easy target for kernel write vulnerabilities, since they reveal the
locations of writable structures containing easily triggerable function
pointers. The behavior of %pK depends on the kptr_restrict sysctl.
If kptr_restrict is set to 0, no deviation from the standard %p behavior
occurs. If kptr_restrict is set to 1, the default, if the current user
(intended to be a reader via seq_printf(), etc.) does not have CAP_SYSLOG
(currently in the LSM tree), kernel pointers using %pK are printed as 0's.
If kptr_restrict is set to 2, kernel pointers using %pK are printed as
0's regardless of privileges. Replacing with 0's was chosen over the
default "(null)", which cannot be parsed by userland %p, which expects
"(nil)".
[akpm@linux-foundation.org: check for IRQ context when !kptr_restrict, save an indent level, s/WARN/WARN_ONCE/]
[akpm@linux-foundation.org: coding-style fixup]
[randy.dunlap@oracle.com: fix kernel/sysctl.c warning]
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: James Morris <jmorris@namei.org>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Thomas Graf <tgraf@infradead.org>
Cc: Eugene Teo <eugeneteo@kernel.org>
Cc: Kees Cook <kees.cook@canonical.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: David S. Miller <davem@davemloft.net>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Eric Paris <eparis@parisplace.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'Documentation')
-rw-r--r-- | Documentation/sysctl/kernel.txt | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt index 574067194f38..11d5ceda5bb0 100644 --- a/Documentation/sysctl/kernel.txt +++ b/Documentation/sysctl/kernel.txt | |||
@@ -34,6 +34,7 @@ show up in /proc/sys/kernel: | |||
34 | - hotplug | 34 | - hotplug |
35 | - java-appletviewer [ binfmt_java, obsolete ] | 35 | - java-appletviewer [ binfmt_java, obsolete ] |
36 | - java-interpreter [ binfmt_java, obsolete ] | 36 | - java-interpreter [ binfmt_java, obsolete ] |
37 | - kptr_restrict | ||
37 | - kstack_depth_to_print [ X86 only ] | 38 | - kstack_depth_to_print [ X86 only ] |
38 | - l2cr [ PPC only ] | 39 | - l2cr [ PPC only ] |
39 | - modprobe ==> Documentation/debugging-modules.txt | 40 | - modprobe ==> Documentation/debugging-modules.txt |
@@ -261,6 +262,19 @@ This flag controls the L2 cache of G3 processor boards. If | |||
261 | 262 | ||
262 | ============================================================== | 263 | ============================================================== |
263 | 264 | ||
265 | kptr_restrict: | ||
266 | |||
267 | This toggle indicates whether restrictions are placed on | ||
268 | exposing kernel addresses via /proc and other interfaces. When | ||
269 | kptr_restrict is set to (0), there are no restrictions. When | ||
270 | kptr_restrict is set to (1), the default, kernel pointers | ||
271 | printed using the %pK format specifier will be replaced with 0's | ||
272 | unless the user has CAP_SYSLOG. When kptr_restrict is set to | ||
273 | (2), kernel pointers printed using %pK will be replaced with 0's | ||
274 | regardless of privileges. | ||
275 | |||
276 | ============================================================== | ||
277 | |||
264 | kstack_depth_to_print: (X86 only) | 278 | kstack_depth_to_print: (X86 only) |
265 | 279 | ||
266 | Controls the number of words to print when dumping the raw | 280 | Controls the number of words to print when dumping the raw |